The Linux kernel’s catc USB driver uses hard‑coded endpoint numbers without first verifying the descriptors supplied by a USB device. A malicious or malformed USB device can present those endpoints with transfer types different from what the driver assumes, which may cause the driver to use incorrect pipes. This flaw can prevent proper device operation and may trigger a kernel panic or other instability when the driver interacts with the mis‑described endpoints. The impact is limited to the machine on which the device is attached; it does not provide remote code execution, but it can compromise device availability and overall system stability.

All Linux kernel releases that include the unpatched catc driver. The vulnerability exists in every kernel before the commit that introduces explicit endpoint checking and the catc_usb_ep enumeration. Vendors and products affected are therefore all Linux distributions that ship kernel images prior to this fix.

The flaw can be exploited by inserting a crafted USB device with local physical access to the target machine. No public evidence shows remote exploitation or widespread attacks, and the vulnerability is not listed in the CISA KEV catalog. The EPSS score is unavailable, indicating no current exploitation data. Because the flaw only manifests during probe time and requires a device that supplies incorrect descriptors, the likelihood of exploitation is low. However, the potential for device denial or kernel instability warrants prompt remediation.